设计思路
- 远程申请内存
- 利用汇编指令在系统API开头劫持跳转
- 当自己的代码执行完再重新跳转回目标API
示例代码如下
386
.model flat, stdcall ;32 bit memory model
option casemap :none ;case sensitive
include Inject.inc
.code
InjectCode:
pop eax
pushad
pushfd
mov eax,006a9ec0h
mov eax,[eax]
mov eax,[eax+768h]
mov eax,[eax+0bch]
.if eax < 4
popfd
popad
jmp offset InjectEnd
.endif
mov eax,006a9ec0h
mov eax,[eax]
mov eax,[eax+768h]
add eax,0bch
dec dword ptr[eax]
popfd
popad
mov edi,20
mov eax,20
InjectEnd:
push ecx
push ebx
push ebp
mov ebp,dword ptr [esp+10h]
push esi
push edi
db 0e9h
Label2:
dd 29d14000h
HookCode:
push eax
Label1:
mov eax,12345678h
jmp eax
Inject proc
LOCAL @hWnd:HWND
LOCAL @dwPID:DWORD
LOCAL @hProcess:HANDLE
LOCAL @pBuff:PVOID
LOCAL @dwNumber:DWORD
LOCAL @hThread:DWORD
LOCAL @hUser32:DWORD
LOCAL @pfnMsgBox:DWORD
LOCAL @dwOld:DWORD
LOCAL @mymd:MODULEENTRY32
LOCAL @hSnapshot:HANDLE
LOCAL @newAdd:DWORD
;远程线程注入
;1.FindWindow
invoke FindWindow, offset g_ClassName, NULL
.if eax == NULL
ret
.endif
mov @hWnd, eax
;2.获取进程pid
invoke GetWindowThreadProcessId, @hWnd, addr @dwPID
;3.打开进程
invoke OpenProcess,PROCESS_ALL_ACCESS, FALSE, @dwPID
.if eax == NULL
ret
.endif
mov @hProcess, eax
;4.远程申请内存
invoke VirtualAllocEx,@hProcess, NULL, 1000h, MEM_COMMIT, PAGE_EXECUTE_READWRITE
.if eax == NULL
jmp SAFE_EXIT
.endif
mov @pBuff, eax
push @pBuff
;修改内存保护属性
invoke VirtualProtect,offset InjectCode, 1000h, PAGE_EXECUTE_READWRITE, addr @dwOld
;修改对方内存保护属性
invoke VirtualProtectEx,@hProcess,40d120h, 1000h, PAGE_EXECUTE_READWRITE, addr @dwOld
;修正hook代码
mov eax,offset Label1
inc eax
mov ebx,@pBuff
mov [eax],ebx
;修正注入代码
mov eax,@pBuff
add eax,48h
mov ebx,40d129h
sub ebx,eax
sub ebx,5
mov eax,offset Label2
mov [eax],ebx
;4.写入劫持代码
invoke WriteProcessMemory,@hProcess,
40d120h,
offset HookCode,
offset Inject - offset HookCode,
addr @dwNumber
.if !eax
jmp SAFE_EXIT
.endif
;5.写入代码
invoke WriteProcessMemory,@hProcess,
@pBuff,
offset InjectCode,
offset HookCode - offset InjectCode,
addr @dwNumber
.if !eax
jmp SAFE_EXIT
.endif
SAFE_EXIT:
.if @hThread != NULL
invoke CloseHandle, @hThread
.endif
.if @hProcess != NULL
invoke CloseHandle,@hProcess
.endif
ret
Inject endp
start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke InitCommonControls
invoke DialogBoxParam,hInstance,IDD_DIALOG1,NULL,addr DlgProc,NULL
invoke ExitProcess,0
;########################################################################
DlgProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM
mov eax,uMsg
.if eax==WM_INITDIALOG
.elseif eax==WM_COMMAND
mov eax, wParam
.if ax == BTN_INJECT
invoke Inject
.endif
.elseif eax==WM_CLOSE
invoke EndDialog,hWin,0
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
DlgProc endp
end start